{"id":"GHSA-rr42-h8r2-f28g","kind":"vulnerability","aliases":["GHSA-rr42-h8r2-f28g"],"related":[],"title":"Unbounded BasicAuth password length gives ~1857x CPU amplification through MD5-crypt, pre-authentication","description":"## Summary\r\n\r\nThere is a potential vulnerability in Traefik's BasicAuth middleware. The middleware does not limit the length of the password before it hashes it, and the MD5-crypt hash formats (`$apr1$`, `$1$`) take more CPU time as the password gets longer. An unauthenticated attacker can send requests with passwords up to the entry point `maxHeaderBytes` limit (1 MiB by default) and use a large amount of CPU on each request, which degrades the availability of Traefik. The patched versions reject passwords longer than 1024 bytes.\r\n\r\n## Patches\r\n\r\n- https://github.com/traefik/traefik/releases/tag/v2.11.62\r\n- https://github.com/traefik/traefik/releases/tag/v3.7.18\r\n- https://github.com/traefik/traefik/releases/tag/v3.8.0-rc.2\r\n\r\n## For more information\r\n\r\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","summary":"Traefik's BasicAuth middleware hashes passwords of any length with MD5-crypt, whose cost grows with password length. An unauthenticated attacker can send very long passwords, up to the 1 MiB header limit by default, to use large amounts of CPU per request and degrade availability.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/traefik/traefik/v2","fixed":["v2.11.62"],"affected":"<= v2.11.61","ecosystem":"go"},{"name":"github.com/traefik/traefik/v3","fixed":["v3.7.18"],"affected":">= v3.0.0, <= v3.7.17","ecosystem":"go"},{"name":"github.com/traefik/traefik/v3","fixed":["v3.8.0-rc.2"],"affected":">= v3.8.0-rc.1, <= v3.8.0-rc.1","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-770","infrastructure","kubernetes","self-hosted","traefik"],"not_affected_if":["managed-hosting","no-basicauth-middleware"],"how_to_check":"- Check the Traefik version with `traefik version` and compare it against the affected ranges.\n- Look for `basicAuth` middleware using `$apr1$` or `$1$` MD5-crypt hashes in the dynamic configuration.","fix":"- Traefik v2: move to `v2.11.62`\n- Traefik v3: move to `v3.7.18`\n- Traefik v3.8.0-rc.1: move to `v3.8.0-rc.2`","status":"open","published_at":"2026-11-12T10:01:25+00:00","first_seen_at":"2026-11-12T10:09:07+00:00","triaged_at":"2026-11-12T10:10:21+00:00","updated_at":"2026-11-12T10:10:21+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-12T10:10:21Z","model":"claude-haiku-5-5","output":{"fix":"- Traefik v2: move to `v2.11.62`\n- Traefik v3: move to `v3.7.18`\n- Traefik v3.8.0-rc.1: move to `v3.8.0-rc.2`","reach":"internet","title":"Traefik: BasicAuth accepts unlimited password length, enabling pre-auth CPU exhaustion","impact":"low","summary":"Traefik's BasicAuth middleware hashes passwords of any length with MD5-crypt, whose cost grows with password length. An unauthenticated attacker can send very long passwords, up to the 1 MiB header limit by default, to use large amounts of CPU per request and degrade availability.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["traefik","self-hosted","kubernetes"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Traefik becomes slow or unavailable through CPU exhaustion from long passwords","analyst_note":"","how_to_check":"- Check the Traefik version with `traefik version` and compare it against the affected ranges.\n- Look for `basicAuth` middleware using `$apr1$` or `$1$` MD5-crypt hashes in the dynamic configuration.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-basicauth-middleware","managed-hosting"],"who_is_affected":"Teams that run Traefik with BasicAuth middleware using MD5-crypt password hashes are exposed, since the flaw is reachable before authentication. Traefik deployments without BasicAuth, or that use other hash formats, are not described as affected by the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000812,"input_tokens":4978,"output_tokens":628,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-770':36B '/traefik/traefik/issues).':206C '/traefik/traefik/releases/tag/v2.11.62':180C '/traefik/traefik/releases/tag/v3.7.18':183C '/traefik/traefik/releases/tag/v3.8.0-rc.2':186C '/traefik/traefik/v2':28A '/traefik/traefik/v3':31A,34A '1':73B,123C,148C '1024':175C '1857x':6A 'advisori':199C 'amount':82B,156C 'amplif':8A 'apr1':122C 'attack':64B,135C 'authent':15A 'avail':89B,165C 'basicauth':2A,45B,99C 'byte':176C 'comment':196C 'cost':57B 'cpu':7A,84B,126C,158C 'crypt':12A,55B,119C 'cwe':35B 'default':78B,151C 'degrad':88B,163C 'entri':144C 'f28g':20A,25A 'format':121C 'get':131C 'ghsa':17A,22A 'ghsa-rr42-h8r2-f28g':16A,21A 'github.com':27A,30A,33A,179C,182C,185C,205C 'github.com/traefik/traefik/issues).':204C 'github.com/traefik/traefik/releases/tag/v2.11.62':178C 'github.com/traefik/traefik/releases/tag/v3.7.18':181C 'github.com/traefik/traefik/releases/tag/v3.8.0-rc.2':184C 'github.com/traefik/traefik/v2':26A 'github.com/traefik/traefik/v3':29A,32A 'give':5A 'grow':58B 'h8r2':19A,24A 'hash':47B,113C,120C 'header':75B 'host':41B 'inform':189C 'infrastructur':37B 'issu':203C 'kubernet':38B 'larg':81B,155C 'length':4A,51B,61B,107C 'limit':76B,105C,147C 'long':68B 'longer':132C,173C 'maxheaderbyt':146C 'md5':11A,54B,118C 'md5-crypt':10A,53B,117C 'mib':74B,149C 'middlewar':46B,100C,102C 'open':201C 'password':3A,48B,60B,69B,110C,130C,140C,172C 'patch':169C,177C 'per':85B 'pleas':200C 'point':145C 'potenti':94C 'pre':14A 'pre-authent':13A 'question':194C 'reject':171C 'request':86B,138C,161C 'rr42':18A,23A 'self':40B 'self-host':39B 'send':66B,137C 'summari':90C 'take':124C 'time':127C 'traefik':42B,43B,97C,167C 'unauthent':63B,134C 'unbound':1A 'use':80B,153C 'version':170C 'vulner':95C 'whose':56B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Traefik with BasicAuth middleware using MD5-crypt password hashes are exposed, since the flaw is reachable before authentication. Traefik deployments without BasicAuth, or that use other hash formats, are not described as affected by the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomtraefiktraefikv2","githubcomtraefiktraefikv3"],"ptokens":["com","github","traefik","v2","v3"],"labels":["cwe770","go","infrastructure","kubernetes","medium","selfhosted","traefik"],"campaign_type":null,"search_a":"'/traefik/traefik/v2':28A '/traefik/traefik/v3':31A,34A '1857x':6A 'amplif':8A 'authent':15A 'basicauth':2A 'cpu':7A 'crypt':12A 'f28g':20A,25A 'ghsa':17A,22A 'ghsa-rr42-h8r2-f28g':16A,21A 'github.com':27A,30A,33A 'github.com/traefik/traefik/v2':26A 'github.com/traefik/traefik/v3':29A,32A 'give':5A 'h8r2':19A,24A 'length':4A 'md5':11A 'md5-crypt':10A 'password':3A 'pre':14A 'pre-authent':13A 'rr42':18A,23A 'unbound':1A","search_b":"'-770':36B '1':73B 'amount':82B 'attack':64B 'avail':89B 'basicauth':45B 'cost':57B 'cpu':84B 'crypt':55B 'cwe':35B 'default':78B 'degrad':88B 'grow':58B 'hash':47B 'header':75B 'host':41B 'infrastructur':37B 'kubernet':38B 'larg':81B 'length':51B,61B 'limit':76B 'long':68B 'md5':54B 'md5-crypt':53B 'mib':74B 'middlewar':46B 'password':48B,60B,69B 'per':85B 'request':86B 'self':40B 'self-host':39B 'send':66B 'traefik':42B,43B 'unauthent':63B 'use':80B 'whose':56B","search_c":"'/traefik/traefik/issues).':206C '/traefik/traefik/releases/tag/v2.11.62':180C '/traefik/traefik/releases/tag/v3.7.18':183C '/traefik/traefik/releases/tag/v3.8.0-rc.2':186C '1':123C,148C '1024':175C 'advisori':199C 'amount':156C 'apr1':122C 'attack':135C 'avail':165C 'basicauth':99C 'byte':176C 'comment':196C 'cpu':126C,158C 'crypt':119C 'default':151C 'degrad':163C 'entri':144C 'format':121C 'get':131C 'github.com':179C,182C,185C,205C 'github.com/traefik/traefik/issues).':204C 'github.com/traefik/traefik/releases/tag/v2.11.62':178C 'github.com/traefik/traefik/releases/tag/v3.7.18':181C 'github.com/traefik/traefik/releases/tag/v3.8.0-rc.2':184C 'hash':113C,120C 'inform':189C 'issu':203C 'larg':155C 'length':107C 'limit':105C,147C 'longer':132C,173C 'maxheaderbyt':146C 'md5':118C 'md5-crypt':117C 'mib':149C 'middlewar':100C,102C 'open':201C 'password':110C,130C,140C,172C 'patch':169C,177C 'pleas':200C 'point':145C 'potenti':94C 'question':194C 'reject':171C 'request':138C,161C 'send':137C 'summari':90C 'take':124C 'time':127C 'traefik':97C,167C 'unauthent':134C 'use':153C 'version':170C 'vulner':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T10:01:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-rr42-h8r2-f28g","url":"https://github.com/traefik/traefik/security/advisories/GHSA-rr42-h8r2-f28g","severity":"medium","published_at":"2026-11-12T10:01:25+00:00","modified_at":"2026-11-12T10:01:25+00:00","first_seen_at":"2026-11-12T10:09:07+00:00","fetched_at":"2026-11-12T10:09:07+00:00","note":null}],"documents":[{"id":133898,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-rr42-h8r2-f28g","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}